otto-intel-mcp 0.1.2 → 0.1.3

package/dist/execution-delegation-cap-store.js

@@ -0,0 +1,1083 @@
+/**
+ * execution-delegation-cap-store.ts — the durable, TRANSACTIONAL state machine behind a person's chosen
+ * per-swap cap (Founder word `delegate cap choice`, 2026-09-02; ROUND 5, after four codex NO-GOs).
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE THREAT MODEL THIS ENFORCES (Founder ruling, 2026-09-03, verbatim)
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * "The per-person delegation cap protects every delegated send that goes through Otto's page
+ * (/app/delegate) and Otto's CLI (otto-execute delegate). A permission a person mints or revokes
+ * directly against Coinbase with their own login, outside Otto's page and CLI, is OUT OF SCOPE: Otto
+ * cannot distinguish it (CDP returns no grant identity, only an expiry) and does not defend against it;
+ * the CDP project-scope $5,000 ceiling remains the hard backstop for every permission. The delegated
+ * agent never holds the person's login."
+ *
+ * Everything below is built to be correct INSIDE that model. Where a defect is only reachable by a
+ * direct-to-Coinbase mint or revoke, the behaviour is stated rather than defended — and every one of
+ * those paths still fails CLOSED here (an unrecorded or unconfirmed grant authorises nothing at all),
+ * so the out-of-scope actor can shorten what Otto may do, never widen it.
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 WHY THE MACHINE, AND WHY IT IS SQLITE
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * Round 3 made the expiry unique among ROWS and thought that was enough. The gate's two CRITICALs:
+ *
+ *   "The durable row still authenticates an expiry, not a grant. Enforcement requires only
+ *    (userId, grant.expiresAt); it does not require a successful confirmation, the reservation's
+ *    mintKey, or an active-grant pointer."
+ *   "Confirmation is not an enforcement gate. Reserve writes the complete enforceable capability;
+ *    confirm writes no state at all."
+ *
+ * Both are the same defect: a reserved row was a BEARER CAPABILITY keyed by an instant. Round 4 took the
+ * gate's own minimum safe model —
+ *
+ *      reserved ──confirm──▶ confirmed_active ──┬──▶ superseded   (a later confirm won)
+ *          │                                     ├──▶ revoked      (the person, or a mismatch)
+ *          └──10 min──▶ expired                  └──▶ (expiry passes)
+ *
+ * — and made ONE thing authoritative: `readActive`. A reserved row authorises NOTHING; the send gate
+ * reads the confirmed-active record and requires its expiry to equal the live grant's.
+ *
+ * Round 4 implemented that on filesystem primitives (`open(…,'wx')` + `rename()`), and round 4's gate
+ * retired them: *"`rename()` gives atomic visibility of one pointer, not durability or a multi-file
+ * transaction: there is no file/directory `fsync`, and confirmation performs three writes … There is
+ * also no confirm CAS/serialization. My concurrent-confirm probe returned both calls as `confirmed` and
+ * left both reservation files `confirmed_active`, although only one `active.json` won."* Its prescription
+ * was explicit: *"Use a transactional shared store with unique `(userId, expiry)` and `(userId, mintKey)`
+ * constraints, an active-grant CAS, and atomic confirm/revoke transitions. A database transaction is the
+ * simpler safe implementation."*
+ *
+ * So the primitives are now SQL, on one database file on the mounted Railway volume:
+ *
+ *   · `PRIMARY KEY (user_id, mint_key)` — the mint key is claimed exactly once. Idempotent reserve.
+ *   · `UNIQUE (user_id, expires_at_ms)` — the reservation instant is claimed exactly once, ACROSS
+ *     processes, by the database rather than by a directory entry.
+ *   · `CHECK (state IN …)` — a record can never hold a state this binary does not know.
+ *   · `active_grants` — ONE ROW PER USER, the only pointer enforcement reads, moved by a
+ *     COMPARE-AND-SWAP (`UPDATE … WHERE mint_key = <prior> AND expires_at_ms = <prior>`) inside the
+ *     same transaction that promotes the reservation.
+ *   · Every transition is a CONDITIONAL UPDATE whose `changes` count decides the winner
+ *     (`UPDATE … WHERE state = 'reserved'`), so a concurrent double confirm has exactly one winner and
+ *     the loser is told it was superseded — it is not a race that both sides win.
+ *   · `BEGIN IMMEDIATE` takes the write lock before the first read, so a reserve/confirm/revoke is
+ *     serialized against every other writer on the same file, in this process or another.
+ *   · `journal_mode = WAL`, `synchronous = FULL` — a committed transition survives a crash and a power
+ *     loss, which is the durability `rename()` did not give.
+ *
+ * ⚠️ THE PREMISE, STATED. One database file, reached by every worker: `numReplicas: 1` and one mounted
+ * volume. SQLite's locking is per file, so two volumes would be two independent stores — and two
+ * independent stores can each confirm a different cap for one person, which is the one shape that could
+ * widen a permission from inside the model. Nothing inside a process can check this; the deploy does
+ * (`railway.json`), and the staged first rollout below is what proves it before minting is even possible.
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 WHY `node:sqlite` AND NOT `better-sqlite3`
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * `better-sqlite3` installs fine on this image (verified: a prebuilt linux-x64 / Node 22 binary, no
+ * compile). It is not a Railway problem. It is a PUBLISHED-PACKAGE problem: `otto-intel-mcp` ships to npm
+ * and is run as `npx otto-intel-mcp`, and `services/otto-execute` vendors it file-for-file at build time.
+ * A hard native dependency becomes a node-gyp source build wherever no prebuild matches the platform
+ * (musl/Alpine, a newer Node ABI, some ARM builds) and fails the install for every user of the CLI,
+ * including the majority who never touch delegation. `node:sqlite` is in the Node standard library at
+ * this package's own engine floor (`node >= 22`), needs no build step, and gives the identical
+ * primitives: `BEGIN IMMEDIATE` transactions, UNIQUE/CHECK constraints, conditional UPDATE with a
+ * `changes` count, WAL and `synchronous = FULL`.
+ *
+ * It is imported LAZILY and the failure is named: a runtime without `node:sqlite` opens an UNAVAILABLE
+ * store, and every delegated send then refuses by name rather than falling back to anything.
+ *
+ * 🔴 IT FAILS CLOSED, LOUDLY. No durable path configured, a database that cannot be opened, or a record
+ * that cannot be parsed means every delegated send refuses. An unreadable store is NOT an empty one, and
+ * the difference decides whether a person's cap is honoured.
+ *
+ * Nothing here logs a token, an address or a credential. A record is a user id, a mint key, two instants,
+ * a number, a version and a state.
+ */
+import { mkdir, readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/** The explicit path override; otherwise the mounted Railway volume is used. */
+export const DELEGATION_CAP_STORE_PATH_ENV = 'OTTO_DELEGATION_CAP_STORE_PATH';
+const RAILWAY_VOLUME_ENV = 'RAILWAY_VOLUME_MOUNT_PATH';
+const CAP_STORE_DIR_NAME = 'delegation-caps';
+/** The database file inside that directory. The directory is kept so a legacy import can still read it. */
+export const CAP_STORE_DB_FILE = 'caps.db';
+/**
+ * 🔴 THE STAGED-DEPLOY GATE (gate finding, CRITICAL 2 — the first rolling deployment).
+ *
+ * "The ruleset handshake cannot fence the first rolling deployment. The version refusal exists only in
+ * the new binary … status/reserve/confirm may hit a new worker while prepare/submit hits a still-serving
+ * old worker, which cannot interpret `requiredVersion` and executes anyway."
+ *
+ * The handshake cannot fix that, because the binary that must refuse is the one that has never heard of
+ * it. A DEPLOYMENT SEQUENCE can, and this flag is what makes the sequence possible:
+ *
+ *   1. deploy with `DELEGATION_MINT_ENABLED` unset or false — no new permission can be created at all,
+ *      so there is no cap-bearing grant for an old worker to execute at the ceiling;
+ *   2. confirm exactly one cap-aware worker is serving (`/health` reports `rulesetVersion`);
+ *   3. set the flag true and redeploy.
+ *
+ * DEFAULT FALSE IN CODE. An operator who forgets the variable gets the paused surface, never an
+ * unfenced first rollout. Sends under permissions that are ALREADY confirmed keep working under their
+ * own cap, and REVOKE always works — pausing the creation of authority must never pause its withdrawal.
+ */
+export const DELEGATION_MINT_ENABLED_ENV = 'DELEGATION_MINT_ENABLED';
+/** True only for an explicit affirmative value. Absent, empty, or anything else is FALSE. */
+export function resolveDelegationMintEnabled(env = process.env) {
+    const raw = env[DELEGATION_MINT_ENABLED_ENV]?.trim().toLowerCase();
+    return raw === 'true' || raw === '1' || raw === 'yes' || raw === 'on';
+}
+/** The one sentence every paused surface says. No security narration: it is an update, and it is short. */
+export const DELEGATION_MINT_PAUSED_MESSAGE = 'Delegation is paused for a few minutes while we update it';
+/**
+ * The shape a mint key must have: what `createDelegation({ idempotencyKey })` accepts, bounded so it
+ * cannot be used as a path or a smuggling channel. A UUID satisfies it.
+ */
+export const MINT_KEY_PATTERN = /^[A-Za-z0-9_-]{16,100}$/;
+/** A CDP end-user id, as every schema on this surface bounds it. */
+export const END_USER_ID_PATTERN = /^[a-zA-Z0-9-]{1,100}$/;
+/**
+ * How far back the offset ladder may walk, in whole seconds, before it refuses.
+ *
+ * Five minutes of headroom on a grant measured in days: invisible to the reader, far more collisions
+ * than a real person can produce, and bounded so a corrupt or adversarially stuffed table cannot turn a
+ * request into one that never returns.
+ */
+export const CAP_EXPIRY_MAX_OFFSET_STEPS = 300;
+/**
+ * 🔴 A RESERVATION THAT IS NEVER CONFIRMED DIES (seat ruling, round 4). Ten minutes is long enough for a
+ * person to finish an OTP sign-in and a mint, and short enough that an abandoned reservation stops being
+ * something a later actor could try to confirm. Its SECOND stays taken — releasing it would let a
+ * different permission land on an instant this one may already have minted at.
+ */
+export const CAP_RESERVATION_WINDOW_MS = 10 * 60_000;
+/**
+ * The version of the CAP RULESET this binary implements — distinct from the fence policy's version,
+ * which describes what Coinbase enforces.
+ *
+ * 🔴 WHY IT EXISTS (gate finding, HIGH — rolling deploy). "An older worker that accepts the same fence
+ * but lacks per-user cap enforcement can execute a new $10 permission up to the engine ceiling." The
+ * fence is identical on both binaries, so the fence cannot tell them apart. Every record carries the
+ * ruleset version it REQUIRES, a worker refuses a record it is too old to honour, and the page and the
+ * CLI refuse to reserve or mint against a server that reports a version below this one.
+ *
+ * 🔴 AND IT IS DEFENCE IN DEPTH, NOT THE FENCE FOR THE FIRST ROLLOUT — that is
+ * `DELEGATION_MINT_ENABLED` above, because a binary that predates the handshake cannot honour it.
+ */
+/** v2 (fence v2, 2026-09-03): a permission minted under v2 consents to Yield Copilot vault WITHDRAWS as well as swaps/deposits. */
+export const MODEL_B_CAP_RULESET_VERSION = 2;
+/** The lifecycle of one permission, as the gate prescribed it, plus the one state a MIGRATION writes. */
+export const CAP_RECORD_STATES = [
+    'reserved',
+    'confirmed_active',
+    'superseded',
+    'revoked',
+    'expired',
+    /**
+     * 🔴 IMPORTED FROM A PRE-SQLITE STORE, AND AUTHORISING NOTHING. The filesystem store's records cannot
+     * be trusted as confirmations — nothing about them was written under a transaction — so the migration
+     * imports every one of them as `legacy`: never `confirmed_active`, never confirmable, never returned
+     * by `readActive`. Its instant STAYS CONSUMED, so no later permission can land on it. The consequence
+     * is accepted and stated on the page: a grant minted before this ships must be re-minted once.
+     */
+    'legacy',
+];
+export class DelegationCapExpiryUnavailableError extends Error {
+    constructor(steps) {
+        super(`no free expiry instant within ${steps} seconds of the requested one`);
+        this.name = 'DelegationCapExpiryUnavailableError';
+    }
+}
+/* ------------------------------------------------------------------ *
+ * Paths and pure helpers.
+ * ------------------------------------------------------------------ */
+export function resolveDelegationCapStorePath(env = process.env) {
+    const explicit = env[DELEGATION_CAP_STORE_PATH_ENV]?.trim();
+    if (explicit)
+        return explicit;
+    const volume = env[RAILWAY_VOLUME_ENV]?.trim();
+    if (volume)
+        return `${volume.replace(/\/+$/, '')}/${CAP_STORE_DIR_NAME}`;
+    return null;
+}
+function assertIdentifiers(userId, mintKey) {
+    if (!END_USER_ID_PATTERN.test(userId))
+        throw new Error('the end user id is not a usable identity');
+    if (mintKey !== undefined && !MINT_KEY_PATTERN.test(mintKey))
+        throw new Error('the mint key is not a usable identity');
+}
+/** The instant `ms` floored to a whole second — the only granularity CDP preserves. */
+export function wholeSecondMs(ms) {
+    return Math.floor(ms / 1000) * 1000;
+}
+/**
+ * The value that goes ON THE WIRE for a reserved second.
+ *
+ * 🔴 CDP REFUSES a `.000` fraction — 401 `unauthorized` "Wallet authentication error", a code that says
+ * nothing about the cause (isolated live on one session, 2026-09-02: `.000Z` refused, `.137Z` accepted
+ * on the very next call, `.000Z` refused again). And it TRUNCATES the fraction when it stores the grant
+ * (`…:46.001Z` → `…:46Z`, `…:45.999Z` → `…:45Z`), so any millisecond in 1..999 lands on the reserved
+ * second and none of them lengthens the permission.
+ */
+export const MINT_EXPIRY_FILLER_MS = 1;
+export function mintExpiryForSecond(wholeSecondIso) {
+    const instant = Date.parse(wholeSecondIso);
+    if (!Number.isFinite(instant))
+        throw new Error('the reserved expiry is not a parseable instant');
+    return new Date(wholeSecondMs(instant) + MINT_EXPIRY_FILLER_MS).toISOString();
+}
+/**
+ * The offset ladder as a pure function: the first whole second at or BEFORE `latestMs` that `taken`
+ * does not hold and that is still in the future, or undefined. It NEVER returns anything later than
+ * `latestMs` — a permission must not outlive the duration the person chose, not even by a second.
+ */
+export function firstFreeExpiryMs(latestMs, nowMs, taken, maxSteps = CAP_EXPIRY_MAX_OFFSET_STEPS) {
+    const start = wholeSecondMs(latestMs);
+    for (let step = 0; step < maxSteps; step += 1) {
+        const candidate = start - step * 1000;
+        // Stepping back must never walk into the past: an already-expired reservation matches no usable grant.
+        if (candidate <= nowMs)
+            return undefined;
+        if (!taken(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/** A record's state as of `nowMs`: a reservation whose window has passed reads as `expired`. */
+export function stateAsOf(record, nowMs) {
+    if (record.state !== 'reserved')
+        return record.state;
+    const reservedAt = Date.parse(record.reservedAt);
+    if (!Number.isFinite(reservedAt))
+        return 'expired';
+    return nowMs - reservedAt > CAP_RESERVATION_WINDOW_MS ? 'expired' : 'reserved';
+}
+/**
+ * 🔴 A MALFORMED DURABLE RECORD FAILS CLOSED (gate finding, MEDIUM). A row that exists and cannot be
+ * read as a record is not an absent row: `readActive` THROWS on one rather than answering "nothing is
+ * confirmed", because those two answers have opposite consequences. The database's own CHECK and NOT
+ * NULL constraints make this nearly unreachable — which is the point of moving to them — but the
+ * direction is still stated in code rather than assumed.
+ */
+class CorruptCapRecordError extends Error {
+    constructor(where) {
+        super(`a durable per-swap cap record could not be read (${where})`);
+        this.name = 'CorruptCapRecordError';
+    }
+}
+function recordFromRow(row, where) {
+    if (row === undefined)
+        return undefined;
+    const expiresAtMs = Number(row.expires_at_ms);
+    const reservedAtMs = Number(row.reserved_at_ms);
+    if (typeof row.user_id !== 'string' ||
+        typeof row.mint_key !== 'string' ||
+        !Number.isFinite(expiresAtMs) ||
+        !Number.isFinite(reservedAtMs) ||
+        typeof row.state !== 'string' ||
+        !CAP_RECORD_STATES.includes(row.state) ||
+        !Number.isInteger(Number(row.cap_usd)) ||
+        !Number.isInteger(Number(row.required_version))) {
+        throw new CorruptCapRecordError(where);
+    }
+    const requestedMs = Number(row.requested_expires_at_ms);
+    const confirmedAtMs = row.confirmed_at_ms === null ? undefined : Number(row.confirmed_at_ms);
+    const endedAtMs = row.ended_at_ms === null ? undefined : Number(row.ended_at_ms);
+    return Object.freeze({
+        userId: row.user_id,
+        mintKey: row.mint_key,
+        expiresAt: new Date(expiresAtMs).toISOString(),
+        requestedExpiresAt: new Date(Number.isFinite(requestedMs) ? requestedMs : expiresAtMs + MINT_EXPIRY_FILLER_MS).toISOString(),
+        perSwapCapUsd: Number(row.cap_usd),
+        requiredVersion: Number(row.required_version),
+        revokeGeneration: Number.isFinite(Number(row.revoke_generation))
+            ? Number(row.revoke_generation)
+            : 0,
+        state: row.state,
+        reservedAt: new Date(reservedAtMs).toISOString(),
+        ...(confirmedAtMs !== undefined && Number.isFinite(confirmedAtMs)
+            ? { confirmedAt: new Date(confirmedAtMs).toISOString() }
+            : {}),
+        ...(endedAtMs !== undefined && Number.isFinite(endedAtMs)
+            ? { endedAt: new Date(endedAtMs).toISOString() }
+            : {}),
+    });
+}
+/**
+ * The schema. Every constraint here is a control, not bookkeeping:
+ *   · `PRIMARY KEY (user_id, mint_key)` makes the mint key claimable once — reserve is idempotent.
+ *   · `UNIQUE (user_id, expires_at_ms)` makes the enforcement instant claimable once, across processes.
+ *   · `CHECK (state IN …)` makes an unknown state unwritable.
+ *   · `active_grants` holds AT MOST ONE ROW PER USER by its primary key — the single pointer the send
+ *     gate reads, moved only by a compare-and-swap on its prior value.
+ */
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS reservations (
+  user_id                 TEXT    NOT NULL,
+  mint_key                TEXT    NOT NULL,
+  expires_at_ms           INTEGER NOT NULL,
+  requested_expires_at_ms INTEGER NOT NULL,
+  cap_usd                 INTEGER NOT NULL,
+  required_version        INTEGER NOT NULL,
+  state                   TEXT    NOT NULL CHECK (state IN ('reserved','confirmed_active','superseded','revoked','expired','legacy')),
+  reserved_at_ms          INTEGER NOT NULL,
+  revoke_generation       INTEGER NOT NULL DEFAULT 0,
+  confirmed_at_ms         INTEGER,
+  ended_at_ms             INTEGER,
+  PRIMARY KEY (user_id, mint_key)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS reservations_user_expiry
+  ON reservations (user_id, expires_at_ms);
+CREATE TABLE IF NOT EXISTS active_grants (
+  user_id       TEXT    NOT NULL PRIMARY KEY,
+  mint_key      TEXT    NOT NULL,
+  expires_at_ms INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS revoke_generations (
+  user_id    TEXT    NOT NULL PRIMARY KEY,
+  generation INTEGER NOT NULL,
+  bumped_at_ms INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS store_meta (
+  key   TEXT NOT NULL PRIMARY KEY,
+  value TEXT NOT NULL
+);
+`;
+function readPragmas(db) {
+    const journal = db.prepare('PRAGMA journal_mode').get();
+    const sync = db.prepare('PRAGMA synchronous').get();
+    return Object.freeze({
+        journalMode: String(journal?.journal_mode ?? '').toLowerCase(),
+        synchronous: Number(sync?.synchronous ?? -1),
+    });
+}
+class SqliteDelegationCapStore {
+    db;
+    available = true;
+    /** What this connection actually has in force. Asserted by the suite; read by nothing else. */
+    pragmas;
+    constructor(db, pragmas) {
+        this.db = db;
+        this.pragmas = pragmas;
+    }
+    static open(db) {
+        /**
+         * 🔴 WAL + `synchronous = FULL` — a committed transition is on disk before the call returns, which
+         * is what `rename()` did not give. `busy_timeout` makes a concurrent writer WAIT for the lock rather
+         * than fail: a reserve that lost a race must walk the ladder, not refuse the person.
+         */
+        db.exec('PRAGMA journal_mode = WAL');
+        db.exec('PRAGMA synchronous = FULL');
+        db.exec('PRAGMA busy_timeout = 5000');
+        const applied = readPragmas(db);
+        db.exec(SCHEMA);
+        return new SqliteDelegationCapStore(db, applied);
+    }
+    close() {
+        try {
+            this.db.close();
+        }
+        catch {
+            // Closing twice, or closing a handle the process is already tearing down, is not a failure.
+        }
+    }
+    /**
+     * One write transaction. `BEGIN IMMEDIATE` takes the write lock BEFORE the first read, so a
+     * read-then-decide-then-write sequence cannot interleave with another writer's — the property a
+     * deferred transaction would not have given.
+     */
+    #transact(body) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const value = body();
+            this.db.exec('COMMIT');
+            return value;
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch {
+                // A transaction the failure already ended cannot be rolled back again; the original error stands.
+            }
+            throw error;
+        }
+    }
+    /**
+     * One READ transaction: a deferred `BEGIN`, so the pointer, the row and the generation an enforcement
+     * read compares are all seen at ONE committed instant (WAL gives a reader its own snapshot, and never
+     * blocks a writer). Three separate statements could straddle a Stop or a confirm; none of the
+     * interleavings widens anything, but an authoritative read should not have to argue that.
+     */
+    #snapshot(body) {
+        this.db.exec('BEGIN');
+        try {
+            const value = body();
+            this.db.exec('COMMIT');
+            return value;
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch {
+                // Already ended; the original error stands.
+            }
+            throw error;
+        }
+    }
+    #readByMintKey(userId, mintKey) {
+        const row = this.db
+            .prepare('SELECT * FROM reservations WHERE user_id = ? AND mint_key = ?')
+            .get(userId, mintKey);
+        return recordFromRow(row, 'reservations by mint key');
+    }
+    /** This person's revoke generation, 0 until their first Stop. */
+    #readGeneration(userId) {
+        const row = this.db
+            .prepare('SELECT generation FROM revoke_generations WHERE user_id = ?')
+            .get(userId);
+        if (row === undefined)
+            return 0;
+        const generation = Number(row.generation);
+        if (!Number.isFinite(generation))
+            throw new CorruptCapRecordError('revoke_generations');
+        return generation;
+    }
+    /** The generation write, INSIDE a caller's transaction: read the counter, write counter + 1. */
+    #bumpGenerationRow(userId, nowMs) {
+        const next = this.#readGeneration(userId) + 1;
+        this.db
+            .prepare(`INSERT INTO revoke_generations (user_id, generation, bumped_at_ms) VALUES (?, ?, ?)
+           ON CONFLICT(user_id) DO UPDATE SET generation = excluded.generation,
+                                              bumped_at_ms = excluded.bumped_at_ms`)
+            .run(userId, next, nowMs);
+        return next;
+    }
+    /**
+     * The record transition, INSIDE a caller's transaction: whatever record the pointer names moves
+     * `confirmed_active → revoked`, decided by the row (`WHERE state = 'confirmed_active'`), and the
+     * instant it held is answered. A pointer at a row that is not confirmed-active changes nothing.
+     */
+    #revokeActiveRow(userId, nowMs) {
+        const pointer = this.#readActiveRow(userId);
+        if (!pointer)
+            return undefined;
+        const ended = this.db
+            .prepare(`UPDATE reservations SET state = 'revoked', ended_at_ms = ?
+           WHERE user_id = ? AND mint_key = ? AND state = 'confirmed_active'`)
+            .run(nowMs, userId, pointer.mintKey);
+        return Number(ended.changes) === 1 ? new Date(pointer.expiresAtMs).toISOString() : undefined;
+    }
+    bumpRevokeGeneration(userId, nowMs) {
+        try {
+            assertIdentifiers(userId);
+            return Promise.resolve(this.#transact(() => this.#bumpGenerationRow(userId, nowMs)));
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    stop(userId, nowMs) {
+        try {
+            assertIdentifiers(userId);
+            /**
+             * 🔴 ONE `BEGIN IMMEDIATE`, BOTH WRITES. The write lock is held from before the generation read to
+             * after the row transition, so no reserve, confirm or second Stop interleaves, and a failure
+             * anywhere inside rolls BOTH back — never a bumped generation beside a record that still stands.
+             * The single-transaction shape is what the crash-injection test and the split-transaction
+             * mutation in the suite prove; do not lift either write out of this closure.
+             */
+            return Promise.resolve(this.#transact(() => {
+                const generation = this.#bumpGenerationRow(userId, nowMs);
+                const revokedExpiresAt = this.#revokeActiveRow(userId, nowMs);
+                return Object.freeze(revokedExpiresAt === undefined ? { generation } : { generation, revokedExpiresAt });
+            }));
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    #readActiveRow(userId) {
+        const row = this.db
+            .prepare('SELECT mint_key, expires_at_ms FROM active_grants WHERE user_id = ?')
+            .get(userId);
+        if (row === undefined)
+            return undefined;
+        const expiresAtMs = Number(row.expires_at_ms);
+        if (typeof row.mint_key !== 'string' || !Number.isFinite(expiresAtMs))
+            throw new CorruptCapRecordError('active_grants');
+        return { mintKey: row.mint_key, expiresAtMs };
+    }
+    reserve(userId, mintKey, latestExpiresAt, perSwapCapUsd, nowMs) {
+        try {
+            assertIdentifiers(userId, mintKey);
+            const latestMs = Date.parse(latestExpiresAt);
+            if (!Number.isFinite(latestMs))
+                throw new Error('the requested expiry is not a parseable instant');
+            return Promise.resolve(this.#transact(() => {
+                /**
+                 * (1) THE MINT KEY IS THE IDEMPOTENCY KEY. A retry after a lost response finds its own row and
+                 * returns the same instant rather than consuming a second one. Read INSIDE the transaction, so
+                 * the answer cannot be overtaken between the read and the insert below.
+                 */
+                const standing = this.#readByMintKey(userId, mintKey);
+                if (standing) {
+                    return Object.freeze({
+                        outcome: 'already_reserved',
+                        record: Object.freeze({ ...standing, state: stateAsOf(standing, nowMs) }),
+                    });
+                }
+                /**
+                 * (2) THE UNIQUE INSERT. `UNIQUE (user_id, expires_at_ms)` is the cross-process exclusion the
+                 * append-only log did not have and the directory entry only approximated: exactly one row can
+                 * hold a second, the loser's insert changes nothing, and it walks EARLIER.
+                 */
+                // The generation in force RIGHT NOW, read inside the same transaction: a Stop that lands
+                // after this reservation is written is what cancels it, and one that landed before is
+                // already reflected here.
+                const generation = this.#readGeneration(userId);
+                const insert = this.db.prepare(`INSERT INTO reservations
+               (user_id, mint_key, expires_at_ms, requested_expires_at_ms, cap_usd, required_version, state, reserved_at_ms, revoke_generation)
+             VALUES (?, ?, ?, ?, ?, ?, 'reserved', ?, ?)
+             ON CONFLICT DO NOTHING`);
+                const start = wholeSecondMs(latestMs);
+                for (let step = 0; step < CAP_EXPIRY_MAX_OFFSET_STEPS; step += 1) {
+                    const candidate = start - step * 1000;
+                    // Stepping back must never walk into the past, and never FORWARD past the chosen duration.
+                    if (candidate <= nowMs)
+                        break;
+                    const written = insert.run(userId, mintKey, candidate, candidate + MINT_EXPIRY_FILLER_MS, perSwapCapUsd, MODEL_B_CAP_RULESET_VERSION, nowMs, generation);
+                    if (Number(written.changes) !== 1)
+                        continue;
+                    return Object.freeze({
+                        outcome: 'reserved',
+                        record: Object.freeze({
+                            userId,
+                            mintKey,
+                            expiresAt: new Date(candidate).toISOString(),
+                            requestedExpiresAt: new Date(candidate + MINT_EXPIRY_FILLER_MS).toISOString(),
+                            perSwapCapUsd,
+                            requiredVersion: MODEL_B_CAP_RULESET_VERSION,
+                            revokeGeneration: generation,
+                            state: 'reserved',
+                            reservedAt: new Date(nowMs).toISOString(),
+                        }),
+                    });
+                }
+                throw new DelegationCapExpiryUnavailableError(CAP_EXPIRY_MAX_OFFSET_STEPS);
+            }));
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    readReservation(userId, mintKey, nowMs) {
+        try {
+            assertIdentifiers(userId, mintKey);
+            const record = this.#readByMintKey(userId, mintKey);
+            return Promise.resolve(record ? Object.freeze({ ...record, state: stateAsOf(record, nowMs) }) : undefined);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    confirm(userId, mintKey, grantExpiresAt, nowMs) {
+        try {
+            assertIdentifiers(userId, mintKey);
+            return Promise.resolve(this.#transact(() => {
+                const stored = this.#readByMintKey(userId, mintKey);
+                if (!stored)
+                    return { outcome: 'unreserved' };
+                const record = Object.freeze({ ...stored, state: stateAsOf(stored, nowMs) });
+                const active = this.#readActiveRow(userId);
+                if (record.state === 'confirmed_active') {
+                    /**
+                     * 🔴 ONE-SHOT, AND THIS IS THE HALF THAT MATTERS. A record that WAS active and has since
+                     * been superseded must never be revived by a second confirm — that would resurrect a
+                     * replaced permission, which on a wider cap is exactly the widening this unit exists to
+                     * prevent. It is still confirmed only while it is the one `active_grants` names.
+                     *
+                     * 🔴 AND THE LIVE GRANT MUST STILL BE THE ONE IT NAMES (gate finding, MEDIUM — round 4: "a
+                     * re-confirmed current record never compares the supplied live grant before returning
+                     * `already_confirmed`; my probe passed a different live expiry and still received
+                     * `already_confirmed`"). A retry that carries a DIFFERENT live instant is not a retry.
+                     */
+                    if (active &&
+                        active.mintKey === record.mintKey &&
+                        active.expiresAtMs === Date.parse(record.expiresAt)) {
+                        return Date.parse(grantExpiresAt) === Date.parse(record.expiresAt)
+                            ? { outcome: 'already_confirmed', record }
+                            : { outcome: 'expiry_mismatch', record };
+                    }
+                    return { outcome: 'superseded' };
+                }
+                /**
+                 * 🔴 A SETTLED RECORD IS NEVER BROUGHT BACK. `superseded` (a later confirmation won) and
+                 * `revoked` (the person, or a mismatch) are terminal: promoting either would resurrect a
+                 * permission that was deliberately replaced or taken away. `expired` and `legacy` are their
+                 * own answers because the remedy differs — nothing was ever confirmed, so the person mints
+                 * again.
+                 */
+                if (record.state === 'superseded' || record.state === 'revoked')
+                    return { outcome: 'superseded' };
+                if (record.state !== 'reserved')
+                    return { outcome: 'not_reservable', state: record.state };
+                /**
+                 * 🔴 STOP WINS OVER A MINT THAT WAS ALREADY IN FLIGHT. The person pressed Stop after this
+                 * reservation was taken; promoting it now would hand them the permission they just cancelled.
+                 * Checked BEFORE the expiry so the answer names what actually happened.
+                 */
+                if (record.revokeGeneration !== this.#readGeneration(userId))
+                    return { outcome: 'cancelled' };
+                if (Date.parse(grantExpiresAt) !== Date.parse(record.expiresAt))
+                    return { outcome: 'expiry_mismatch', record };
+                /**
+                 * 🔴 THE ONE-SHOT TRANSITION, ENFORCED BY THE DATABASE. `WHERE state = 'reserved'` means a
+                 * concurrent second confirm changes NO rows and is answered below from the state it lost to —
+                 * exactly one winner, decided by the row and not by who read first. (The gate's round-4 probe
+                 * on the filesystem store: "both calls returned `confirmed` and left both reservation files
+                 * `confirmed_active`, although only one `active.json` won.")
+                 */
+                const promoted = this.db
+                    .prepare(`UPDATE reservations SET state = 'confirmed_active', confirmed_at_ms = ?
+                 WHERE user_id = ? AND mint_key = ? AND state = 'reserved'`)
+                    .run(nowMs, userId, mintKey);
+                if (Number(promoted.changes) !== 1) {
+                    const now = this.#readByMintKey(userId, mintKey);
+                    return now && now.state === 'confirmed_active'
+                        ? { outcome: 'already_confirmed', record: now }
+                        : { outcome: 'superseded' };
+                }
+                const expiresAtMs = Date.parse(record.expiresAt);
+                /**
+                 * 🔴 THE ACTIVE-GRANT POINTER MOVES BY COMPARE-AND-SWAP, in this same transaction. The WHERE
+                 * clause names the value this transaction READ; if anything else moved the pointer, no row
+                 * changes and the whole transition is thrown away rather than half-applied.
+                 */
+                const swapped = active
+                    ? this.db
+                        .prepare(`UPDATE active_grants SET mint_key = ?, expires_at_ms = ?
+                     WHERE user_id = ? AND mint_key = ? AND expires_at_ms = ?`)
+                        .run(mintKey, expiresAtMs, userId, active.mintKey, active.expiresAtMs)
+                    : this.db
+                        .prepare(`INSERT INTO active_grants (user_id, mint_key, expires_at_ms) VALUES (?, ?, ?)
+                     ON CONFLICT DO NOTHING`)
+                        .run(userId, mintKey, expiresAtMs);
+                if (Number(swapped.changes) !== 1) {
+                    throw new Error('the active-grant pointer moved while this permission was being confirmed');
+                }
+                // The permission this one replaces is marked superseded in the SAME transaction — never a
+                // second write that could be lost.
+                if (active && active.expiresAtMs !== expiresAtMs) {
+                    this.db
+                        .prepare(`UPDATE reservations SET state = 'superseded', ended_at_ms = ?
+                   WHERE user_id = ? AND mint_key = ? AND state = 'confirmed_active'`)
+                        .run(nowMs, userId, active.mintKey);
+                }
+                const confirmed = this.#readByMintKey(userId, mintKey);
+                if (!confirmed)
+                    throw new CorruptCapRecordError('reservations after confirm');
+                return { outcome: 'confirmed', record: confirmed };
+            }));
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    readActive(userId, nowMs) {
+        try {
+            assertIdentifiers(userId);
+            return Promise.resolve(this.#snapshot(() => {
+                const pointer = this.#readActiveRow(userId);
+                if (!pointer)
+                    return undefined;
+                const record = this.#readByMintKey(userId, pointer.mintKey);
+                if (!record || record.state !== 'confirmed_active')
+                    return undefined;
+                // The pointer and the row must agree; a pointer at another instant authorises nothing.
+                if (Date.parse(record.expiresAt) !== pointer.expiresAtMs)
+                    return undefined;
+                /**
+                 * 🔴 A RECORD FROM BEFORE THE LAST STOP AUTHORISES NOTHING (gate r5 CRITICAL: "`readActive`
+                 * does not compare the record's generation with the current generation"). A confirmed record
+                 * always carries the generation in force when it was confirmed — `confirm` cancels anything
+                 * older — so a generation that has moved since means a Stop was committed after it. The row
+                 * transition in `stop` is the same transaction, so this is a second, independent reading of
+                 * the same fact: whatever the row says, a Stop after a confirmation means zero authority.
+                 */
+                if (record.revokeGeneration !== this.#readGeneration(userId))
+                    return undefined;
+                // A record whose own expiry has passed authorises nothing, whatever the pointer still says.
+                return Date.parse(record.expiresAt) > nowMs ? record : undefined;
+            }));
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    revoke(userId, expiresAt, nowMs) {
+        try {
+            assertIdentifiers(userId);
+            return Promise.resolve(this.#transact(() => {
+                const pointer = this.#readActiveRow(userId);
+                if (!pointer || pointer.expiresAtMs !== Date.parse(expiresAt))
+                    return false;
+                /**
+                 * 🔴 ONE-SHOT AGAIN, AND THE ROW IS WHAT DECIDES. The transition lands only if the row IS
+                 * confirmed-active, so a second revoke — or one racing a supersession — changes nothing and is
+                 * answered `false`. The POINTER IS DELIBERATELY LEFT WHERE IT IS: `readActive` follows it to
+                 * the row and requires `confirmed_active`, so the state on the row is the single fact that
+                 * decides whether anything may be spent. One place to look, one transition to prove, and the
+                 * row's instant stays consumed so no later permission can land on it.
+                 */
+                const ended = this.db
+                    .prepare(`UPDATE reservations SET state = 'revoked', ended_at_ms = ?
+                 WHERE user_id = ? AND mint_key = ? AND state = 'confirmed_active'`)
+                    .run(nowMs, userId, pointer.mintKey);
+                return Number(ended.changes) === 1;
+            }));
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+    }
+    /**
+     * 🔴 THE MIGRATION, RUN ONCE. Every record a pre-SQLite store holds is imported as `legacy`: never
+     * `confirmed_active`, never confirmable, never returned by `readActive`. Nothing about those records
+     * was written under a transaction, so treating one as a confirmation would be trusting exactly the
+     * primitives the gate retired. Their INSTANTS are kept consumed, so no later permission can land on
+     * one. The consequence — every grant minted before this ships must be re-minted once on
+     * `/app/delegate` — is accepted, and it is the safe direction: an unconfirmed grant refuses rather
+     * than falling back to the shared ceiling.
+     */
+    importLegacy(records) {
+        return this.#transact(() => {
+            const done = this.db
+                .prepare("SELECT value FROM store_meta WHERE key = 'legacy_import'")
+                .get();
+            if (done !== undefined)
+                return 0;
+            const insert = this.db.prepare(`INSERT INTO reservations
+           (user_id, mint_key, expires_at_ms, requested_expires_at_ms, cap_usd, required_version, state, reserved_at_ms, revoke_generation, ended_at_ms)
+         VALUES (?, ?, ?, ?, ?, ?, 'legacy', ?, 0, ?)
+         ON CONFLICT DO NOTHING`);
+            let imported = 0;
+            for (const record of records) {
+                const expiresAtMs = Date.parse(record.expiresAt);
+                const reservedAtMs = Date.parse(record.reservedAt);
+                if (!Number.isFinite(expiresAtMs) || !Number.isFinite(reservedAtMs))
+                    continue;
+                if (!END_USER_ID_PATTERN.test(record.userId))
+                    continue;
+                if (!MINT_KEY_PATTERN.test(record.mintKey))
+                    continue;
+                const written = insert.run(record.userId, record.mintKey, expiresAtMs, expiresAtMs + MINT_EXPIRY_FILLER_MS, record.perSwapCapUsd, record.requiredVersion, reservedAtMs, Date.now());
+                imported += Number(written.changes);
+            }
+            this.db
+                .prepare("INSERT INTO store_meta (key, value) VALUES ('legacy_import', ?)")
+                .run(new Date().toISOString());
+            return imported;
+        });
+    }
+}
+/* ------------------------------------------------------------------ *
+ * Reading whatever a pre-SQLite store left behind.
+ * ------------------------------------------------------------------ */
+/** Parse one JSON record as either store wrote it. Anything unreadable is skipped, never guessed at. */
+function legacyRecordFrom(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const r = value;
+    if (typeof r.userId !== 'string' || typeof r.mintKey !== 'string')
+        return undefined;
+    if (typeof r.expiresAt !== 'string' || !Number.isFinite(Date.parse(r.expiresAt)))
+        return undefined;
+    if (typeof r.perSwapCapUsd !== 'number' || !Number.isInteger(r.perSwapCapUsd))
+        return undefined;
+    if (typeof r.reservedAt !== 'string' || !Number.isFinite(Date.parse(r.reservedAt)))
+        return undefined;
+    return Object.freeze({
+        userId: r.userId,
+        mintKey: r.mintKey,
+        expiresAt: r.expiresAt,
+        requestedExpiresAt: typeof r.requestedExpiresAt === 'string' ? r.requestedExpiresAt : r.expiresAt,
+        perSwapCapUsd: r.perSwapCapUsd,
+        requiredVersion: typeof r.requiredVersion === 'number' && Number.isInteger(r.requiredVersion)
+            ? r.requiredVersion
+            : MODEL_B_CAP_RULESET_VERSION,
+        revokeGeneration: 0,
+        state: 'legacy',
+        reservedAt: r.reservedAt,
+    });
+}
+/**
+ * Everything a pre-SQLite store left in `root`: the round-1/2 append-only JSONL, and the round-4
+ * per-instant JSON files under `u/<userId>/r/`. Read best-effort — a migration that THREW on an
+ * unreadable leftover would stop the store opening at all, and the leftovers authorise nothing either
+ * way.
+ */
+export async function readLegacyCapRecords(root) {
+    const found = [];
+    // (a) the append-only log rounds 1-3 wrote.
+    for (const name of await readdir(root).catch(() => [])) {
+        if (!name.endsWith('.jsonl'))
+            continue;
+        const text = await readFile(join(root, name), 'utf8').catch(() => '');
+        for (const line of text.split('\n')) {
+            const record = line.trim() ? legacyRecordFrom(line) : undefined;
+            if (record)
+                found.push(record);
+        }
+    }
+    // (b) the per-instant files round 4 wrote: <root>/u/<userId>/r/<ms>.json
+    const users = await readdir(join(root, 'u'), { withFileTypes: true }).catch(() => []);
+    for (const user of users) {
+        if (!user.isDirectory())
+            continue;
+        const dir = join(root, 'u', user.name, 'r');
+        for (const name of await readdir(dir).catch(() => [])) {
+            if (!name.endsWith('.json'))
+                continue;
+            const record = legacyRecordFrom(await readFile(join(dir, name), 'utf8').catch(() => ''));
+            if (record)
+                found.push(record);
+        }
+    }
+    return found;
+}
+/* ------------------------------------------------------------------ *
+ * Construction.
+ * ------------------------------------------------------------------ */
+/** A store that is present but permanently unavailable — what an unconfigured deploy gets. */
+export function unavailableDelegationCapStore(reason) {
+    const dead = () => Promise.reject(new Error(reason));
+    return Object.freeze({
+        available: false,
+        unavailableReason: reason,
+        reserve: dead,
+        readReservation: dead,
+        confirm: dead,
+        readActive: dead,
+        revoke: dead,
+        bumpRevokeGeneration: dead,
+        stop: dead,
+    });
+}
+/**
+ * Open the SQLite store at `root`, importing anything a pre-SQLite store left behind as `legacy`.
+ * Exported so a test can open one on a temp directory without going through the environment.
+ */
+export async function openDelegationCapStore(root) {
+    let DatabaseSync;
+    try {
+        /**
+         * 🔴 THE SPECIFIER IS INDIRECT ON PURPOSE, and it is the only reason this is not a plain import.
+         * The dApp's root typecheck compiles this module (a contract test reaches it through the admin
+         * definitions) against `@types/node` 20, which predates `node:sqlite`. A literal specifier would
+         * fail that gate over a module this file only ever touches at RUNTIME, on the hosted worker's Node
+         * 22. The interfaces above keep every call site typed; only the module resolution is given up.
+         */
+        const specifier = 'node:sqlite';
+        ({ DatabaseSync } = (await import(specifier)));
+    }
+    catch {
+        // Node older than the `node:sqlite` release. Named, and fail-closed — never an in-memory fallback.
+        return unavailableDelegationCapStore('this runtime has no node:sqlite, so the per-swap cap cannot be recorded durably; run on Node 22 or newer');
+    }
+    let store;
+    try {
+        await mkdir(root, { recursive: true });
+        store = SqliteDelegationCapStore.open(new DatabaseSync(join(root, CAP_STORE_DB_FILE)));
+    }
+    catch {
+        return unavailableDelegationCapStore('the per-swap cap store could not be opened for writing');
+    }
+    try {
+        const legacy = await readLegacyCapRecords(root);
+        if (legacy.length > 0)
+            store.importLegacy(legacy);
+        else
+            store.importLegacy([]);
+    }
+    catch {
+        // A leftover that cannot be imported does not stop the store: those records authorise nothing here
+        // either way, and the person's remedy is the same re-mint.
+    }
+    return store;
+}
+/**
+ * The store for this process, from the environment. Unconfigured is NOT a silent in-memory fallback: it
+ * is an unavailable store, so the delegated send refuses by name and the ops fix (mount the volume, or
+ * set `OTTO_DELEGATION_CAP_STORE_PATH`) is the thing the refusal asks for.
+ */
+export async function createDelegationCapStore(env = process.env) {
+    const path = resolveDelegationCapStorePath(env);
+    if (!path) {
+        return unavailableDelegationCapStore(`no durable per-swap cap store is configured: set ${DELEGATION_CAP_STORE_PATH_ENV} or mount a volume (${RAILWAY_VOLUME_ENV})`);
+    }
+    return openDelegationCapStore(path);
+}
+/**
+ * An in-memory store — for TESTS and for a local stdio run, where nothing is durable anyway.
+ *
+ * 🔴 IT IMPLEMENTS THE SAME STATE MACHINE, and the suite runs the SAME conformance cases against both,
+ * so a test cannot pass against semantics production does not have. What it cannot model is the
+ * cross-process exclusion and the crash durability SQLite provides — those are asserted against a real
+ * database file, and against two real processes, only.
+ */
+export function inMemoryDelegationCapStore(seed = []) {
+    const reservations = new Map();
+    const mints = new Map();
+    const active = new Map();
+    const generations = new Map();
+    const key = (userId, expiresAt) => `${userId}\n${Date.parse(expiresAt)}`;
+    /** The generation bump, shared by `bumpRevokeGeneration` and `stop` — one decision in one place. */
+    const bump = (userId) => {
+        const next = (generations.get(userId) ?? 0) + 1;
+        generations.set(userId, next);
+        return next;
+    };
+    for (const record of seed) {
+        reservations.set(key(record.userId, record.expiresAt), record);
+        mints.set(`${record.userId}\n${record.mintKey}`, record.expiresAt);
+        if (record.state === 'confirmed_active')
+            active.set(record.userId, record);
+    }
+    const readReservation = (userId, mintKey, nowMs) => {
+        const expiresAt = mints.get(`${userId}\n${mintKey}`);
+        if (expiresAt === undefined)
+            return undefined;
+        const record = reservations.get(key(userId, expiresAt));
+        return record ? Object.freeze({ ...record, state: stateAsOf(record, nowMs) }) : undefined;
+    };
+    const store = {
+        available: true,
+        reserve(userId, mintKey, latestExpiresAt, perSwapCapUsd, nowMs) {
+            try {
+                assertIdentifiers(userId, mintKey);
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
+            const latestMs = Date.parse(latestExpiresAt);
+            if (!Number.isFinite(latestMs))
+                return Promise.reject(new Error('the requested expiry is not a parseable instant'));
+            const standing = readReservation(userId, mintKey, nowMs);
+            if (standing)
+                return Promise.resolve({ outcome: 'already_reserved', record: standing });
+            const chosen = firstFreeExpiryMs(latestMs, nowMs, (candidate) => reservations.has(`${userId}\n${candidate}`));
+            if (chosen === undefined)
+                return Promise.reject(new DelegationCapExpiryUnavailableError(CAP_EXPIRY_MAX_OFFSET_STEPS));
+            const record = Object.freeze({
+                userId,
+                mintKey,
+                expiresAt: new Date(chosen).toISOString(),
+                requestedExpiresAt: new Date(chosen + MINT_EXPIRY_FILLER_MS).toISOString(),
+                perSwapCapUsd,
+                requiredVersion: MODEL_B_CAP_RULESET_VERSION,
+                revokeGeneration: generations.get(userId) ?? 0,
+                state: 'reserved',
+                reservedAt: new Date(nowMs).toISOString(),
+            });
+            reservations.set(key(userId, record.expiresAt), record);
+            mints.set(`${userId}\n${mintKey}`, record.expiresAt);
+            return Promise.resolve({ outcome: 'reserved', record });
+        },
+        readReservation(userId, mintKey, nowMs) {
+            return Promise.resolve(readReservation(userId, mintKey, nowMs));
+        },
+        confirm(userId, mintKey, grantExpiresAt, nowMs) {
+            const record = readReservation(userId, mintKey, nowMs);
+            if (!record)
+                return Promise.resolve({ outcome: 'unreserved' });
+            const live = active.get(userId);
+            if (record.state === 'confirmed_active') {
+                if (live && live.mintKey === record.mintKey && live.expiresAt === record.expiresAt) {
+                    // The same comparison the SQLite store makes: a retry carrying a DIFFERENT live instant is
+                    // not a retry (gate finding, round-4 MEDIUM).
+                    return Promise.resolve(Date.parse(grantExpiresAt) === Date.parse(record.expiresAt)
+                        ? { outcome: 'already_confirmed', record: live }
+                        : { outcome: 'expiry_mismatch', record });
+                }
+                return Promise.resolve({ outcome: 'superseded' });
+            }
+            // Terminal states are never revived — the same rule the SQLite store applies.
+            if (record.state === 'superseded' || record.state === 'revoked')
+                return Promise.resolve({ outcome: 'superseded' });
+            if (record.state !== 'reserved')
+                return Promise.resolve({ outcome: 'not_reservable', state: record.state });
+            // The same rule the SQLite store applies: Stop wins over a mint already in flight.
+            if (record.revokeGeneration !== (generations.get(userId) ?? 0))
+                return Promise.resolve({ outcome: 'cancelled' });
+            if (Date.parse(grantExpiresAt) !== Date.parse(record.expiresAt))
+                return Promise.resolve({ outcome: 'expiry_mismatch', record });
+            const confirmed = Object.freeze({
+                ...record,
+                state: 'confirmed_active',
+                confirmedAt: new Date(nowMs).toISOString(),
+            });
+            // Only a record that IS confirmed-active is superseded — the row's `WHERE state = 'confirmed_active'`.
+            if (live && live.state === 'confirmed_active' && live.expiresAt !== confirmed.expiresAt) {
+                reservations.set(key(userId, live.expiresAt), Object.freeze({ ...live, state: 'superseded', endedAt: new Date(nowMs).toISOString() }));
+            }
+            reservations.set(key(userId, confirmed.expiresAt), confirmed);
+            active.set(userId, confirmed);
+            return Promise.resolve({ outcome: 'confirmed', record: confirmed });
+        },
+        readActive(userId, nowMs) {
+            const record = active.get(userId);
+            if (!record || record.state !== 'confirmed_active')
+                return Promise.resolve(undefined);
+            // The same second reading of a Stop the SQLite store makes: a record from before it authorises nothing.
+            if (record.revokeGeneration !== (generations.get(userId) ?? 0))
+                return Promise.resolve(undefined);
+            return Promise.resolve(Date.parse(record.expiresAt) > nowMs ? record : undefined);
+        },
+        revoke(userId, expiresAt, nowMs) {
+            const record = active.get(userId);
+            if (!record || Date.parse(record.expiresAt) !== Date.parse(expiresAt))
+                return Promise.resolve(false);
+            // 🔴 ONE-SHOT, like the row's `WHERE state = 'confirmed_active'` (gate r5 LOW: the twin answered a
+            // second revoke `true`). A record already revoked, superseded or expired changes nothing.
+            if (record.state !== 'confirmed_active')
+                return Promise.resolve(false);
+            const revoked = Object.freeze({
+                ...record,
+                state: 'revoked',
+                endedAt: new Date(nowMs).toISOString(),
+            });
+            // The pointer stays and the STATE decides — the same shape the SQLite store has.
+            active.set(userId, revoked);
+            reservations.set(key(userId, revoked.expiresAt), revoked);
+            return Promise.resolve(true);
+        },
+        bumpRevokeGeneration(userId) {
+            return Promise.resolve(bump(userId));
+        },
+        stop(userId, nowMs) {
+            // Synchronous, so the two writes are as indivisible here as one transaction makes them in SQLite.
+            const generation = bump(userId);
+            const record = active.get(userId);
+            if (!record || record.state !== 'confirmed_active')
+                return Promise.resolve({ generation });
+            const revoked = Object.freeze({
+                ...record,
+                state: 'revoked',
+                endedAt: new Date(nowMs).toISOString(),
+            });
+            active.set(userId, revoked);
+            reservations.set(key(userId, revoked.expiresAt), revoked);
+            return Promise.resolve({ generation, revokedExpiresAt: revoked.expiresAt });
+        },
+    };
+    return Object.freeze(store);
+}
+//# sourceMappingURL=execution-delegation-cap-store.js.map